Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: In progress This standard defines baseline prevention and detection controls for sensitive-data handling and exfiltration risk.

What this standard answers

  • Which DLP-relevant controls are active today
  • Which policy artifacts are still being formalized
  • How this standard should be interpreted during review

Current state (as of March 5, 2026)

Core preventive controls are implemented through product design and access controls. Formal policy mapping is in progress.

Current control baseline

AreaCurrent control
Data minimizationProduct design limits persistent storage scope
Access controlTenant and role-scoped authorization model
Secrets protectionManaged secret systems and restricted access
Transport and storageEncryption in transit and at rest
MonitoringSecurity and operational event monitoring

In progress

  • Formalized DLP policy mapping and control-to-evidence matrix completion.
  • Target completion: March 2026.

Scope note

This page describes control baseline and policy maturity status. It is not a standalone endpoint DLP product claim.

Exceptions and governance

Any DLP-control exception requires documented risk, compensating controls, and remediation timing. Questions: